September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,314
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93987 rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in... |
low | 3.4 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-89151 Forgejo before 16.0.4 allows use of restricted API tokens for unintended access... |
low | 3.5 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-79300 SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. |
low | 3.5 | — | — | 2026-09-12 | 2026-09-22 |
| CVE-2026-38332 TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch me... |
low | 2.9 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-35867 A Command Injection vulnerability exists in the bs_SetLimitCli_info function wit... |
low | 3.1 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-38924 In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP m... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-22631 PRTG Network Monitor before 23.1.82 allows remote attackers to write to files vi... |
low | 2.7 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24283 Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a b... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24284 Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a b... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24285 Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a b... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24286 Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a b... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24287 Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a b... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24288 An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24291 Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a b... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-32778 An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-88621 OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in... |
low | 2.7 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-77166 The emoji field in the page emoji update endpoint does not properly validate use... |
low | 2.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-23786 An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 13... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-23793 An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and... |
low | 3.5 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33956 An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380,... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33960 An issue was discovered in Samsung Mobile Processor and Wearable Processor Exyno... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33962 An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33966 An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380,... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33967 An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380,... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33968 An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380,... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33970 An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable P... |
low | 3.5 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-22632 PRTG Network Monitor before 23.1.82 allows remote attackers to write to files vi... |
low | 2.7 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24034 An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. |
low | 3.1 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24035 An issue was discovered in Nagios XI before 5.9.3. |
low | 3.5 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-37366 An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-25832 In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accept... |
low | 3.7 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-25825 An issue was discovered in Keyfactor SignServer before 7.6.0. |
low | 2.7 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-25827 An issue was discovered in Keyfactor SignServer before 7.6.0. |
low | 2.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-95818 A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library... |
low | 3.6 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-86551 The Z80Ultra (NX741J) product contains a vulnerability where non-privileged prog... |
low | 3.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-92965 The TikTok WordPress plugin before 1.4.2 does not check that a request is author... |
low | 3.7 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-85220 A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthent... |
low | 3.7 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-85219 Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an... |
low | 3.7 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94218 A flaw was found in the authentication session management of Keycloak, an identi... |
low | 3.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-11545 IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to ob... |
low | 3.7 | — | — | 2026-09-18 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.